Re: [PATCH 5.15 177/570] scsi: core: Fix error handling for scsi_alloc_sdev()

junxiao.bi
2026-04-15T16:21:46Z

On 4/14/26 9:07 AM, Harshit Mogalapalli wrote:

> Hi,
>
> On 13/04/26 21:25, Greg Kroah-Hartman wrote:
>> 5.15-stable review patch.  If anyone has any objections, please let
>> me know.
>>
>> ------------------
>>
>> From: Junxiao Bi <junxiao.bi@oracle.com>
>>
>> commit 4ce7ada40c008fa21b7e52ab9d04e8746e2e9325 upstream.
>>
>> After scsi_sysfs_device_initialize() was called, error paths must call
>> __scsi_remove_device().
>>
>> Fixes: 1ac22c8eae81 ("scsi: core: Fix refcount leak for tagset_refcnt")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
>> Reviewed-by: John Garry <john.g.garry@oracle.com>
>> Reviewed-by: Bart Van Assche <bvanassche@acm.org>
>> Link:
>> https://patch.msgid.link/20260304164603.51528-1-junxiao.bi@oracle.com
>> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> ---
>>   drivers/scsi/scsi_scan.c |    8 ++------
>>   1 file changed, 2 insertions(+), 6 deletions(-)
>>
>> --- a/drivers/scsi/scsi_scan.c
>> +++ b/drivers/scsi/scsi_scan.c
>> @@ -339,12 +339,8 @@ static struct scsi_device *scsi_alloc_sd
>>        * default device queue depth to figure out sbitmap shift
>>        * since we use this queue depth most of times.
>>        */
>> -    if (scsi_realloc_sdev_budget_map(sdev, depth)) {
>> -        kref_put(&sdev->host->tagset_refcnt, scsi_mq_free_tags);
>> -        put_device(&starget->dev);
>> -        kfree(sdev);
>> -        goto out;
>> -    }
>> +    if (scsi_realloc_sdev_budget_map(sdev, depth))
>> +        goto out_device_destroy;
>
> I have run an AI assisted backport review and it spotted an issue: I
> have taken a look and the issue is:
>
>
> 5.15.y doesn't have commit: 21008cabc5d9 ("scsi: core: Move two
> statements") - v6.19-rc1 based so backporting this patch introduces
> something like:
>
>   if (scsi_realloc_sdev_budget_map(sdev, depth))
>           goto out_device_destroy;
>
>   scsi_change_queue_depth(sdev, depth);
>   scsi_sysfs_device_initialize(sdev);
>
>   ...
>   out_device_destroy:
>           __scsi_remove_device(sdev);
>
>
> calling put_device() before  device_initialize(), so I think we should
> drop this patch in stable branches which don't have commit:
> 21008cabc5d9 ("scsi: core: Move two statements") in them. Upstream
> moved scsi_sysfs_device_initialize() above the budget_map() call.
>
> Thoughts ?
>
Right, this commit should be backported as well. Otherwise we could see
this warning.

"kobject: '%s' (%p): is not initialized, yet kobject_put() is being
called.\n"

Thanks,

Junxiao.

> I see the same problem in other stable branches as well.
>
> Thanks,
> Harshit
>
>
>>       scsi_change_queue_depth(sdev, depth);
>>
>>
>>
>